Page History

Functions that can fail spuriously should be wrapped in a loop.  The atomic_compare_exchange_weak() and atomic_compare_exchange_weak_explicit() functions both attempt to set an atomic variable to a new value but only if it currently possesses a known old value. Unlike the related functions atomic_compare_exchange_strong() and atomic_compare_exchange_strong_explicit(), these functions are permitted to "fail spuriously," which makes them faster on some platforms. This makes these functions faster on some platforms—for example, on architectures that implement compare-and-exchange using load-linked/store-conditional instructions, such as Alpha, ARM, MIPS, and PowerPC. The C Standard describes this behavior in subclause , 7.17.7.4, paragraph 45 [ISO/IEC 9899:2024], describes this behavior:

A weak compare-and-exchange operation may fail spuriously. That is, even when the contents of memory referred to by expected and object are equal, it may return zero and store back to expected the same memory contents that were originally there.

Noncompliant Code Example

This noncompliant code example calls the In this noncompliant code example, reorganize_data_structure() is to be used as an argument to thrd_create().  After reorganizing, the function attempts to replace the head pointer so that it points to the new version.  If no other thread has changed the head pointer since it was originally loaded, reorganize_data_structure() is intended to exit the thread with a result of true, indicating success.  Otherwise, the new reorganization attempt is discarded and the thread is exited with a result of false.  However, atomic_compare_exchange_weak() outside of a loop . () may fail even when the head pointer has not changed. Therefore, reorganize_data_structure() may perform the work and then discard it unnecessarily.

#include <stdbool<stdatomic.h>
#include <stdatomic<stdbool.h>
 
static atomic_bool cur;
 
void init_flag(void) {
  atomic_init(&cur, false);
}
 
void func(void) {
 init_flag();
 
 bool exp
struct data {
  struct data *next;
  /* ... */
};

extern void cleanup_data_structure(struct data *head);

int reorganize_data_structure(void *thread_arg) {
  struct data *_Atomic *ptr_to_head = thread_arg;
  struct data *old_head = atomic_load(&cur);
 bool des = !exp;
 
  if (!ptr_to_head);
  struct data *new_head;
  bool success;

  /* ... Reorganize the data structure ... */

  success = atomic_compare_exchange_weak(&cur, &exp, des)ptr_to_head,
                                         &old_head, new_head);
  if (!success) {
    cleanup_data_structure(new_head);
  }
  return success; /* HandleExit the errorthread */
  }
}

Compliant Solution (atomic_compare_exchange_weak())

A consequence of spurious failure is that nearly all uses of weak compare-and-exchange will be in a loop. This compliant solution calls the To recover from spurious failures, a loop must be used.  However, atomic_compare_exchange_weak() function from within a while loop to ensure the function does not fail spuriously.  When a might fail because the head pointer changed, or the failure may be spurious. In either case, the thread must perform the work repeatedly until the compare-and-exchange is in a loop, the weak version will yield better performance on some platforms.succeeds, as shown in this compliant solution:

#include <stdatomic.h>
#include <stdbool.h>
#include <stdatomic<stddef.h>

static atomic_bool cur;

void init_flag(void) {
  atomic_init(&cur, false);
}
 
void func(void) {
  init_flag();
 
  bool exp
struct data {
  struct data *next;
  /* ... */
};

extern void cleanup_data_structure(struct data *head);

int reorganize_data_structure(void *thread_arg) {
  struct data *_Atomic *ptr_to_head = thread_arg;
  struct data *old_head = atomic_load(&curptr_to_head);
  bool desstruct data *new_head = !expNULL;
  struct data *saved_old_head;
  bool success;

  do {
    if (new_head != NULL) {
      cleanup_data_structure(new_head);
    }
    dessaved_old_head = !expold_head;

  /* ... Reorganize the data structure ... */

  } while (!(success = atomic_compare_exchange_weak(&cur
               ptr_to_head, &exp, des));
}old_head, new_head
             )) && old_head == saved_old_head);
  return success; /* Exit the thread */
}

This loop could also be part of a larger control flow; for example, the thread from the noncompliant code example could be retried if it returns false.

Compliant Solution (atomic_compare_exchange_strong())

When a weak compare-and-exchange would require a loop and a strong one would not, the strong one is preferable., as in this compliant solution:

#include <stdbool<stdatomic.h>
#include <stdatomic<stdbool.h>

static atomic_bool cur;

void init_flag(void) {
  atomic_init(&cur, false);
}
 
void func(voidstruct data {
  struct data *next;
  /* ... */
};

extern void cleanup_data_structure(struct data *head);

int reorganize_data_structure(void *thread_arg) {
  init_flag()struct data *_Atomic *ptr_to_head = thread_arg;
 
 struct bool expdata *old_head = atomic_load(&curptr_to_head);
  struct  bool des = !exp;
 
  if (!data *new_head;
  bool success;

  /* ... Reorganize the data structure ... */

  success = atomic_compare_exchange_strong(&cur
    ptr_to_head, &exp, desold_head, new_head
  );
  if (!success) {
    cleanup_data_structure(new_head);
  }
  return success; /* Exit Handlethe errorthread */
  }
}

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Bibliography

Image Removed Image Removed Image RemovedImage Added Image Added Image Added